From 19667dd6f11e21320b1913d38fc316e7adcd36e4 Mon Sep 17 00:00:00 2001
From: Krystine Sherwin <93062060+KrystalDelusion@users.noreply.github.com>
Date: Fri, 29 Aug 2025 11:35:16 +1200
Subject: [PATCH 1/2] CI: Don't use self-hosted runner on forks

---
 .github/workflows/prepare-docs.yml | 2 +-
 .github/workflows/test-build.yml   | 2 +-
 .github/workflows/test-verific.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/prepare-docs.yml b/.github/workflows/prepare-docs.yml
index a02febb3b..17d37d08c 100644
--- a/.github/workflows/prepare-docs.yml
+++ b/.github/workflows/prepare-docs.yml
@@ -26,7 +26,7 @@ jobs:
     # docs builds are needed for anything on main, any tagged versions, and any tag
     # or branch starting with docs-preview
     needs: check_docs_rebuild
-    if: ${{ needs.check_docs_rebuild.outputs.should_skip != 'true' }}
+    if: ${{ needs.check_docs_rebuild.outputs.should_skip != 'true' && github.repository == 'YosysHQ/Yosys' }}
     runs-on: [self-hosted, linux, x64, fast]
     steps:
       - name: Checkout Yosys
diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
index 65d931797..d7f2073fe 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/test-build.yml
@@ -253,7 +253,7 @@ jobs:
     name: Try build docs
     runs-on: [self-hosted, linux, x64, fast]
     needs: [pre_docs_job]
-    if: needs.pre_docs_job.outputs.should_skip != 'true'
+    if: ${{ needs.pre_docs_job.outputs.should_skip != 'true' && github.repository == 'YosysHQ/Yosys' }}
     strategy:
       matrix:
         docs-target: [html, latexpdf]
diff --git a/.github/workflows/test-verific.yml b/.github/workflows/test-verific.yml
index 9af07b920..c2e4228c4 100644
--- a/.github/workflows/test-verific.yml
+++ b/.github/workflows/test-verific.yml
@@ -27,7 +27,7 @@ jobs:
 
   test-verific:
     needs: pre-job
-    if: needs.pre-job.outputs.should_skip != 'true'
+    if: ${{ needs.pre-job.outputs.should_skip != 'true' && github.repository == 'YosysHQ/Yosys' }}
     runs-on: [self-hosted, linux, x64, fast]
     steps:
       - name: Checkout Yosys

From 6f7cd637cb36ccecf7d2928ffef7c5a285fa7df1 Mon Sep 17 00:00:00 2001
From: Krystine Sherwin <93062060+KrystalDelusion@users.noreply.github.com>
Date: Tue, 23 Sep 2025 15:02:45 +1200
Subject: [PATCH 2/2] CI: Check repo for YosysHQ specific jobs

Prevents unintended bumps on the flake.lock and Yosys version on forks (provided the forks synchronize their main after this gets merged).
Update version.yml to use the same style of `if` on the job, rather than on specific actions.
Wheels will still build as a cron job, but won't try to upload if it's a fork.
---
 .github/workflows/update-flake-lock.yml | 1 +
 .github/workflows/version.yml           | 8 +++-----
 .github/workflows/wheels.yml            | 1 +
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml
index de7ef04d6..b32498baf 100644
--- a/.github/workflows/update-flake-lock.yml
+++ b/.github/workflows/update-flake-lock.yml
@@ -6,6 +6,7 @@ on:
 
 jobs:
   lockfile:
+    if: github.repository == 'YosysHQ/Yosys'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 26dcba4a4..78d34db46 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -7,6 +7,7 @@ on:
 
 jobs:
   bump-version:
+    if: github.repository == 'YosysHQ/Yosys'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -18,11 +19,8 @@ jobs:
       - name: Take last commit
         id: log
         run: echo "message=$(git log --no-merges -1 --oneline)" >> $GITHUB_OUTPUT
-      - name: Take repository
-        id: repo
-        run: echo "message=$GITHUB_REPOSITORY" >> $GITHUB_OUTPUT
       - name: Bump version
-        if: "!contains(steps.log.outputs.message, 'Bump version') && contains(steps.repo.outputs.message, 'YosysHQ/yosys')"
+        if: ${{ !contains(steps.log.outputs.message, 'Bump version') }}
         run: |
           make bumpversion
           git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
@@ -30,7 +28,7 @@ jobs:
           git add Makefile
           git commit -m "Bump version"
       - name: Push changes # push the output folder to your repo
-        if: "!contains(steps.log.outputs.message, 'Bump version') && contains(steps.repo.outputs.message, 'YosysHQ/yosys')"
+        if: ${{ !contains(steps.log.outputs.message, 'Bump version') }}
         uses: ad-m/github-push-action@master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index 41d9183fc..2a5b7e024 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -124,6 +124,7 @@ jobs:
           path: ./wheelhouse/*.whl
   upload_wheels:
     name: Upload Wheels
+    if: github.repository == 'YosysHQ/Yosys'
     runs-on: ubuntu-latest
     # Specifying a GitHub environment is optional, but strongly encouraged
     environment: pypi